romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-28 17:23:06 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookie: check __Secure- and __Host- case sensitively when read from file

Browse source 
The header path matches these prefixes case sensitively, as 5af0165562
made it for cookie spec reasons, but the Netscape cookie-file path still
used a case-insensitive match. Align the file path so a differently
cased name like __secure-x is treated as an ordinary cookie instead of
being put through the prefix integrity checks.

Extended test 2311 to cover it.

Closes #22085
This commit is contained in:
alhudz 2026-06-18 20:01:20 +05:30 • committed by Daniel Stenberg
parent e44f1a1446
commit fdd6ba3580
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/cookie.c
View file

@ -759,10 +759,12 @@ static CURLcode parse_netscape(struct Cookie *co,
if(!co->name)
return CURLE_OUT_OF_MEMORY;
else {
/* For Netscape file format cookies we check prefix on the name */
if(curl_strnequal("__Secure-", co->name, 9))
/* For Netscape file format cookies we check prefix on the name.
These prefixes are matched case sensitively, same as on the
header path and as the 6265bis document specifies. */
if(!strncmp("__Secure-", co->name, 9))
co->prefix_secure = TRUE;
else if(curl_strnequal("__Host-", co->name, 7))
else if(!strncmp("__Host-", co->name, 7))
co->prefix_host = TRUE;
}
break;

6
tests/data/test2311
View file

@ -26,7 +26,7 @@ This server says moo
http
</server>
<name>
Cookie from file with control octet in value is rejected
Cookie from file: control octet rejected, prefixes matched case sensitively
</name>
<command>
http://example.fake/%TESTNUMBER -b %LOGDIR/injar%TESTNUMBER -x %HOSTIP:%HTTPPORT
@ -34,6 +34,8 @@ http://example.fake/%TESTNUMBER -b %LOGDIR/injar%TESTNUMBER -x %HOSTIP:%HTTPPORT
<file name="%LOGDIR/injar%TESTNUMBER">
example.fake FALSE / FALSE 0 clean good
example.fake FALSE / FALSE 0 bad %hex[ba%07d]hex%
example.fake FALSE / FALSE 0 __secure-x yes
example.fake FALSE / FALSE 0 __Secure-y no
</file>
<features>
cookies
@ -49,7 +51,7 @@ Host: example.fake
User-Agent: curl/%VERSION
Accept: */*
Proxy-Connection: Keep-Alive
Cookie: clean=good
Cookie: __secure-x=yes; clean=good
</protocol>
</verify>